PM43/PM43c mid-range industrial RFID printers are ideal for a wide range of applications within the distribution center / warehouse and manufacturing environments.

II. ADVISORY

Using a bad file permission, it is possible to gain full root privilege on a PM43 (but not only) RFID industrial printer as well as from the admin account as it-admin which are the two default users on the machine.
It also permits to gain full privilege resulting on a Busybox jailbreak due to the root access on the system.

The impact of this exploitation is quite critical due to the sensitive information that are available and impact the recent firmware version release (before March 12th 2017).

III. VULNERABILITY DESCRIPTION

The Lua binary rights are too permissive and this one is SUID which conduct to perform this privilege escalation using a basic trick as describe in the next section.
The default it-admin and/or admin credentials are available in the vendor's documentation and should be modified too.

IV. PROOF OF CONCEPT

Following steps can reproduce the privilege escalation once the attacker gain a Busybox shell on the system:

As explained in the above text, we then over-writed the "etc/shadow" file and we validated that it is possible to gain full root access on the filesystem even if Busybox 1.15.0 (2009 release) were present, bypassing
its shell restrictions (jailbreaking it).

V. RECOMMENDATIONS

AKERVA's Pentesters recommended to fix it by modifying the Lua binary rights (is the SUID bit necessary?) which was done in the patched firmware.
A security fix is now available in order to mitigate this issue as shown at the beginning of this advisory.

VI. VERSIONS AFFECTED

This issue affects the firmware version 10.10.011406 but after reading the latest release notes it also seems to impact all versions that were released before the updated firmware.

VII. TIMELINE

January 19th, 2017: Vulnerability identificationJanuary 27th, 2017: First contact with the editor (Honeywell)January 31th, 2017: Advisory submission to Honeywell security team and CVE id requestFebruary 1st, 2017: CVE id attributed by MITRE even if the vendor is not normally considered a priority for CVE by MITREFebruary 6th, 2017: Vendor confirm the vulnerability February 16th, 2017: Vendor inform that the fix is ready (They also proposed me to test it prior to release)March 12th, 2017: New firmware version availableMarch 28th, 2017: Public advisory releasedVIII. LEGAL NOTICES

The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.
I accept no responsibility for any damage caused by the use or misuse of this advisory.